EEF-CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

Summary The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tls\handshake:hello/5 handler validates the negotiated protocol version and the...

CVE-2026-66477

Unauthenticated Broken Access Control in Gillion = 4.13 versions...

CVE-2026-66438

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor = 2.8.0 versions...

CVE-2026-66428

Unauthenticated Cross Site Request Forgery CSRF in WP Google Review Slider = 18.4 versions...

CVE-2026-66427

Administrator SQL Injection in WP Google Review Slider = 18.4 versions...

CVE-2026-66433

Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...

CVE-2026-65567

Unauthenticated Broken Access Control in Event Tickets = 5.29.0.1 versions...

CVE-2026-65433

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-59559

Subscriber Cross Site Scripting XSS in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-59551

Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

CVE-2026-59557

Unauthenticated Broken Access Control in Events Made Easy = 3.1.3 versions...

CVE-2026-59556

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-59538

Unauthenticated SQL Injection in GamiPress = 7.9.7 versions...

CVE-2026-59548

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

CVE-2026-59528

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

CVE-2026-59527

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-10819

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

CVE-2025-59178

Ericsson Packet Core Controller PCC versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system...

CVE-2025-59177

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages...